feat: profile sharing via X25519 envelope (Phase B, #3)

An owner can now share a profile with another account; the recipient
reads the profile's metadata AND its data (medications, appointments,
health stats) under their own login. The server stays a blind store:
sharing uses an X25519 envelope — the owner wraps the profile DEK to
the recipient's identity public key via ECDH (fresh ephemeral key per
share), the recipient unwraps it with their identity private key.

Backend:
- models/profile_share.rs: ProfileShare + ProfileShareRepository
  (find_for_recipient, find_for_profile, find_active [checks active +
  expiry], delete, upsert). Indexed on (profileId, recipientUserId) and
  recipientUserId.
- handlers/profile_share.rs: POST/GET /profiles/:id/shares,
  DELETE /profiles/:id/shares/:recipient, GET /profiles/shared-with-me,
  GET /users/public-key (public), and authorize_profile_read — the
  share-gate that admits owner OR active-share recipient.
- The share-gate is wired into list/get for medications, appointments,
  and health stats: when profile_id is specified, resolve the owner via
  the gate and query as them. Data repos stay ownership-scoped.
- Removed the legacy Share system (ADR Open Q5): models/{share,
  permission}.rs, handlers/{shares,permissions}.rs, middleware/
  permission.rs (dead), the shares collection field + methods in
  mongodb_impl.rs, the shares index, and the 5 /api/shares +
  /api/permissions routes.
- share_tests.rs: full owner→recipient→revoke flow, ownership
  isolation, share-to-self/nonexistent/keyless rejections, expired
  share treated as absent.

Frontend:
- crypto/keys.ts: wrapProfileDekToRecipient /
  unwrapProfileDekFromShare (ECDH envelope, ephemeral key per share).
- useProfileStore: loadSharedWithMe (unwrap each share's DEK with the
  identity private key), shareProfile, revokeShare, loadProfileShares.
  Shared profiles merge into the list with is_shared=true.
- ProfileSwitcher: shows shared profiles with a 'shared' chip.
- ProfileSharing (new) + ProfileEditor: owner UI to add a recipient by
  email and revoke; shared profiles render read-only with owner info.
- ECDH round-trip test (owner wraps, recipient unwraps, stranger can't).

Verification: backend cargo build/clippy (-D warnings)/fmt clean, tests
compile (integration tests run in CI — Mongo is fixed there). Frontend
tsc clean, 31/31 tests pass.

⚠️ Backend integration tests not run locally (no Mongo/Docker in this
sandbox); CI will run them — I'll fix any failures immediately.

Phases C (hard revoke / re-key) and D (graduation) remain. Refs #3.

backend/src/app.rs

@@ -35,7 +35,10 @@ pub fn build_app(state: AppState) -> Router {
             "/api/auth/recover-password",
             post(handlers::recover_password),
         )
-        .route("/api/auth/recovery-info", get(handlers::recovery_info));
+        .route("/api/auth/recovery-info", get(handlers::recovery_info))
+        // Recipient identity public key lookup (Phase B). Public keys are not
+        // secret, so this is unauthenticated — mirrors recovery-info.
+        .route("/api/users/public-key", get(handlers::get_public_key));
 
     // Build protected routes (auth required)
     let protected_routes = Router::new()
@@ -47,19 +50,22 @@ pub fn build_app(state: AppState) -> Router {
         // User settings
         .route("/api/users/me/settings", get(handlers::get_settings))
         .route("/api/users/me/settings", put(handlers::update_settings))
-        // Share management
-        .route("/api/shares", post(handlers::create_share))
-        .route("/api/shares", get(handlers::list_shares))
-        .route("/api/shares/:id", put(handlers::update_share))
-        .route("/api/shares/:id", delete(handlers::delete_share))
-        // Permission checking
-        .route("/api/permissions/check", post(handlers::check_permission))
-        // Profile management (Phase A2: multi-profile + per-profile DEKs)
+        // Profile management (Phase A2 multi-profile + Phase B sharing).
+        // GET /api/profiles/:id is share-aware (admits recipients); the other
+        // profile ops remain owner-only.
         .route("/api/profiles", get(handlers::list_profiles))
         .route("/api/profiles", post(handlers::create_profile))
-        .route("/api/profiles/:id", get(handlers::get_profile))
+        .route("/api/profiles/shared-with-me", get(handlers::list_shared_with_me))
+        .route("/api/profiles/:id", get(handlers::get_profile_shared_aware))
         .route("/api/profiles/:id", put(handlers::update_profile))
         .route("/api/profiles/:id", delete(handlers::delete_profile))
+        // Profile sharing (Phase B): owner manages shares; recipients read via
+        // the gate inside the data handlers.
+        .route(
+            "/api/profiles/:id/shares",
+            get(handlers::list_shares).post(handlers::create_share),
+        )
+        .route("/api/profiles/:id/shares/:recipient", delete(handlers::delete_share))
         // Session management (Phase 2.6)
         .route("/api/sessions", get(handlers::get_sessions))
         .route("/api/sessions/:id", delete(handlers::revoke_session))